Frostmoln Docs

English

Svenska
Suomi
Norsk
Dansk

English

Svenska
Suomi
Norsk
Dansk

Appearance

frostmoln_appgw_waf_exclusion (Resource) ​

Narrows a WAF rule so it stops matching a request shape you know is good — a field that legitimately contains SQL, an upload endpoint, an API that posts XML.

Like a rule, an exclusion lands on the policy's draft and takes effect only when it is published and the gateway applies its configuration.

Target exactly one of target_secrule_id or target_tag.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Enacted and reconciled — every configurable attribute not listed below: the platform applies it, and a refresh reads the truth back.

Create-immutable — gateway_id, policy_id, rule_key: the exclusion is identified by its key within its policy; changing one is a different exclusion.

Example Usage ​

terraform
# Prefer an exclusion over disabling a rule: it narrows the rule to stop
# matching one known-good field on one path, rather than turning it off
# everywhere.

resource "frostmoln_appgw_waf_exclusion" "search_query" {
  gateway_id = frostmoln_application_gateway.edge.id
  policy_id  = frostmoln_appgw_waf_policy.main.id
  rule_key   = "allow-sql-in-search-q"

  target_secrule_id = 942100

  variable     = "ARGS"
  selector     = "q"
  path_pattern = "^/search"

  description = "The search box accepts free text that trips the SQLi rules."
}

Schema ​

Required ​

  • gateway_id (String) The Application Gateway the policy belongs to.
  • policy_id (String) The WAF policy this exclusion belongs to.
  • rule_key (String) Your stable name for this exclusion: 1-64 lowercase letters, digits or hyphens, starting and ending with a letter or digit.
  • variable (String) The variable to exclude from inspection, e.g. ARGS or REQUEST_HEADERS.

Optional ​

  • description (String) Why this exclusion exists. At most 1024 characters.

    Worth filling in: an exclusion is a hole in your firewall, and the next person reviewing it needs to know whether it is still justified.

  • ordinal (Number) Evaluation order within the policy.

  • path_pattern (String) Limit the exclusion to matching request paths, so it applies where the false positive is rather than everywhere. At most 1024 characters.

  • selector (String) A specific field within the variable, e.g. a parameter or header name. Omit to exclude the whole variable, which is much broader — prefer naming the one field that is a false positive.

  • target_secrule_id (Number) The single managed rule to narrow, by its SecRule id.

  • target_tag (String) The tag whose rules to narrow, e.g. attack-sqli. At most 128 characters.

Read-Only ​

  • created_at (String) The creation timestamp.
  • revision (Number) A server-assigned counter, bumped on every write. Feed it into frostmoln_appgw_waf_policy_publication.rule_revisions so a publish is ordered after this exclusion without depends_on.
  • updated_at (String) The last update timestamp.